dependabot / dependabot/dependabot-core
Request: Update both the software version and the os version where both are present (in Docker image tags)
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
We have Docker images which use node and look like the following.
```dockerfile
FROM node:14.18.0-alpine3.12
```
We use Dependabot to keep said image up-to-date. So for example, Dependabot will create a PR that updates this to:
```dockerfile
FROM node:14.18.1-alpine3.12
```
since that is the latest version of node 14 (we have an ignore rule for major versions greater than v14).
However, at present Dependabot doesn't appear to update the base OS. In this case, we would like Dependabot to also bump alpine when new releases become available. In this case I would want Dependabot to update `alpine3.12` to `alpine3.14` (the current release). The end result would be
```dockerfile
FROM node:14.18.1-alpine3.14
```
(Apologies if this has already been requested, I couldn't find it when I searched)
Contributor guide
Research direction
Start with the Dockerfile example and review how Dependabot handles versioned Docker image tags in FROM instructions. Reproduce the node:14.18.0-alpine3.12 case and determine how both the node and Alpine components should be selected while respecting the major-version ignore rule. Done means an update can produce node:14.18.1-alpine3.14 when both versions have newer releases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100